151–160 of 226 posts
This is scary, intentional bullying. It costs the govt none of their own money (they have unlimited taxpayer money) to launch these attacks, but it costs Signal or other organizations a lot of their own money to defend against them. It will continue until Signal agrees to become part of the surveillance state or goes broke and goes away.
Earlier quoted context omitted.
>Smartphones in their current form cannot have secure messaging. What about self-hosted matrix/element, used from the browser?
Anything that is in web browser (like e.g most uses of protonmail) offloads all security to the security of the TLS connection. Unless you also ensure proper certificate pining, if someone can get a court order for any accepted CA to give them a valid certificate for your domain you won't notice a thing while that someone gets your browser to run any code and e.g. dump keys, certificates or messages.
Certificate transparency logs make it possible to notice. I'm not 100% sure, but I think all major browsers require certificates to be logged at this point; and there are several services that you can list your domain and get notified when a certificate is issued.
You (or your users) may still be MITMed with the rogue cert without notice in the browser, though.
Earlier quoted context omitted.
The subpoena is dated 29 march. That puts it before the celebrite blog. Hence, it cannot be a response to that blog.
Fair and astute observation, and it implies prosecutors have been rounding on Signal for months at least before the Cellebrite blog post as well. However, it also means there was already a snare set for them before the post. I would still not underestimate what these people are capable of. If they want to get you, they will find a way to get you.
It's actually comforting to believe your adversary is so powerful that the only thing keeping you safe is their failure to notice you. Because that leaves you with only one reasonable course of action: don't rock the boat.
The reality, however is far more troubling: Even great powers have blind spots, weaknesses and limitations. Though it's not easy, their power can be contested. Which implies that refusing to rock the boat is just laziness or cowardice.
It's unlikely that prosecutors don't realize how Signal works. It's more likely they assume that, much like the rest of the tech world, there has been an increase in data collection efforts and they want to test the waters again to confirm/deny this data is available via Signal internals. Subpoenas are the only mechanism by which they're able to do so. That Signal are able to pivot to the media and say "yup, still co…
Earlier quoted context omitted.
> It's unlikely that prosecutors don't realize how Signal works. Why would you expect them to understand how Signal works? A lawyer does not and cannot become a subject matter expert for every aspect of a case they undertake. A lawyer's job is to investigate every possible avenue for evidence to support their case. They're going to ask Signal for everything imaginable and have legal recourse if they discover at a lat…
They're just going to call up an expert like they do with every industry.
[0] I assume. I don’t do steel.
It's unlikely that prosecutors don't realize how Signal works. It's more likely they assume that, much like the rest of the tech world, there has been an increase in data collection efforts and they want to test the waters again to confirm/deny this data is available via Signal internals. Subpoenas are the only mechanism by which they're able to do so. That Signal are able to pivot to the media and say "yup, still co…
Or the metadata is enough when it comes to evidence. "Person X added person Y on Signal", in context with other evidence, might be all they're looking for.
Earlier quoted context omitted.
Fair and astute observation, and it implies prosecutors have been rounding on Signal for months at least before the Cellebrite blog post as well. However, it also means there was already a snare set for them before the post. I would still not underestimate what these people are capable of. If they want to get you, they will find a way to get you.
> I would still not underestimate what these people are capable of. If they want to get you, they will find a way to get you. It's actually comforting to believe your adversary is so powerful that the only thing keeping you safe is their failure to notice you. Because that leaves you with only one reasonable course of action: don't rock the boat. The reality, however is far more troubling: Even great powers have blin…
I totally lack the skills necessary in this case, but that’s my preference.
Earlier quoted context omitted.
Does the phrase "you are asked" have a legal bearing though? is it something they can just choose to not follow, since they were not "told" or "instructed"?
Given that the following sentence says "If you nonetheless plan to disclose the existence or nature of the subpoena, please contact the Special Agent identified above first". I suspect it might not. I don't know why this additional information wasn't quoted by the parent comment.
It's unlikely that prosecutors don't realize how Signal works. It's more likely they assume that, much like the rest of the tech world, there has been an increase in data collection efforts and they want to test the waters again to confirm/deny this data is available via Signal internals. Subpoenas are the only mechanism by which they're able to do so. That Signal are able to pivot to the media and say "yup, still co…
If I may restate this slightly: > Subpoenas are the only mechanism by which prosecutors are able to test the waters to confirm/deny whether they can demand production of this data I think many people fail to appreciate the importance of setting a precedent in the courts. Maybe this is because our legislators have been shirking responsibility for decades and pushing what should be their work off onto the executive and…
Earlier quoted context omitted.
Yep. Lavabit. Centralized is never raid/DDoS-proof. Okay boys, take all these servers because evidence is hiding on them and these lefty pinkos aren't helping us find it. Let's get them back to the lab to find out what that evidence is.
Afaik, Signal uses AWS. Is a raid/confiscation of AWS servers even possible?